Microsoft has released monthly security update for their products:
| Vulnerable Product | Risk Level | Impacts | Notes |
| Windows | High Risk | Elevation of Privilege Remote Code Execution Security Restriction Bypass Denial of Service Spoofing Information Disclosure |
CVE-2026-21510 is being exploited in the wild. An attacker could bypass Windows SmartScreen and Windows Shell security prompts by exploiting improper handling in Windows Shell components, allowing attacker‑controlled content to execute without user warning or consent. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21513 is being exploited in the wild. Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21519 is being exploited in the wild. Access of resource using incompatible type (‘type confusion’) in Desktop Window Manager allows an authorized attacker to elevate privileges locally. Hence, the risk level of this vulnerability is rated as Medium Risk. CVE-2026-21525 is being exploited in the wild. Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21533 is being exploited in the wild. Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Hence, the risk level of this vulnerability is rated as Medium Risk. |
| Extended Security Updates (ESU) |  High Risk |
Elevation of Privilege Remote Code Execution Security Restriction Bypass Spoofing Denial of Service Information Disclosure |
CVE-2026-21510 is being exploited in the wild. An attacker could bypass Windows SmartScreen and Windows Shell security prompts by exploiting improper handling in Windows Shell components, allowing attacker‑controlled content to execute without user warning or consent. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21513 is being exploited in the wild. Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21519 is being exploited in the wild. Access of resource using incompatible type (‘type confusion’) in Desktop Window Manager allows an authorized attacker to elevate privileges locally. Hence, the risk level of this vulnerability is rated as Medium Risk. CVE-2026-21525 is being exploited in the wild. Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Hence, the risk level of this vulnerability is rated as High Risk.
CVE-2026-21533 is being exploited in the wild. Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Hence, the risk level of this vulnerability is rated as Medium Risk. |
| Developer Tools |  Medium Risk |
Security Restriction Bypass Spoofing Remote Code Execution Elevation of Privilege |
|
| Azure | Medium Risk |
Spoofing Information Disclosure Elevation of Privilege Remote Code Execution |
|
| Microsoft Office | Medium Risk |
Elevation of Privilege Information Disclosure Spoofing Security Restriction Bypass |
CVE-2026-21514 is being exploited in the wild. Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. Hence, the risk level of this vulnerability is rated as Medium Risk. |
| SQL Server | Medium Risk |
Remote Code Execution | |
| Browser |  Low Risk |
Spoofing | |
| Server Software | Low Risk |
Spoofing | |
| System Center | Medium Risk |
Remote Code Execution | |
| Other | Medium Risk |
Remote Code Execution | |
| Apps | Medium Risk |
Remote Code Execution |
Number of ‘Extremely High Risk’ product(s): 0
Number of ‘High Risk’ product(s): 2
Number of ‘Medium Risk’ product(s): 7
Number of ‘Low Risk’ product(s): 2
Evaluation of overall ‘Risk Level’: High Risk